CVE-2026-55590

unknowncovered by 1 sourcefirst seen 2026-07-09

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

⚡ Watch CVE-2026-55590

Get an email if CVE-2026-55590 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-55590: CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 …nvd · 2026-07-09

External references

NVD record for CVE-2026-55590

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55590 status](https://www.csirts.com/badge/CVE-2026-55590)](https://www.csirts.com/cve/CVE-2026-55590)